Re: comment on unmanaged analysis presentation/doc

[Rob Austein <sra+v6ops@hactrn.net>]

At Mon, 23 Sep 2002 16:10:22 +0200 (CEST), Erik Nordmark wrote:
> 
> Stated differently, if you apply IPv4 ingress filtering in the network
> and IPv6 ingress filtering in the IPv6-native parts of the network, the
> use of encapsulation doesn't create additional holes in your filtering.

This is the key point.

While it's somewhat tedious to set up, a 6to4 router can use the usual
topological defenses to keep from letting any bad stuff through.

A 6to4 relay (or a terado relay or an xyz relay) has a much harder
task, because the network topology doesn't tell it much of anything
that it can use as a basis for filtering out the bogons.